Vehicle control system and method for confirming software consistency

ABSTRACT

A specific on-board device, that is any one of a plurality of on-board devices, is configured to acquire the versions of software included in other on-board devices when the power source of a vehicle is turned on. The specific on-board device determines whether or not the versions of the software of all the on-board devices that constitute a vehicle control system are consistent, by comparing the version of the software of the specific on-board device and the versions of the software acquired from the other on-board devices with first consistency information prestored.

This application is a continuation application of U.S. patentapplication Ser. No. 16/279,290, filed on Feb. 19, 2019, which claimspriority to Japanese Patent Application No. 2018-040981, filed on Mar.7, 2018. The disclosure of each application, including thespecification, drawings and abstract, is incorporated herein byreference in its entirety.

BACKGROUND 1. Technical Field

The present disclosure relates to a vehicle control system and a methodfor confirming software consistency.

2. Description of Related Art

Japanese Patent Application Publication No. 2009-53920 (JP 2009-53920 A)discloses a system that updates ECU programs with upgrade programstransmitted from a server. In the system of JP 2009-53920 A, occurrenceof operation failure attributed to inconsistent versions of the ECUprograms is prevented by determining whether or not to update an ECUprogram with reference to information on dependency relation between anupgrade program for the ECU program to be updated and other ECUprograms, before the pertinent program is updated.

SUMMARY

When the versions of a plurality of on-board programs are inconsistent,unexpected vehicle control may possibly be performed. Although thesystem of JP 2009-53920 A confirms the dependency relation between aprogram to be updated and other programs at the time of updating,confirming the dependency relation at the time of updating the programmay be insufficient to prevent the unexpected vehicle control.

The present disclosure provides a vehicle control system and a methodfor confirming software consistency capable of further reducing thepossibility of unexpected vehicle control performed due to inconsistentversions of a plurality of on-board software.

A vehicle control system according to a first aspect of the presentdisclosure includes a plurality of on-board devices, wherein any one ofthe on-board devices is a specific on-board device and the specificon-board device includes: a first consistency information storage unit;a version acquisition unit; and a first determination unit. The firstconsistency information storage unit is configured to prestore firstconsistency information including a permitted combination of versions ofsoftware of all the on-board devices that constitute the vehicle controlsystem. The version acquisition unit is configured to acquire versionsof the software included in other on-board devices when a power sourceof a vehicle is turned on. The other on-board devices are the on-boarddevices other than the specific on-board device. The first determinationunit is configured to determine, when the version acquisition unitacquires the versions of the software from the other on-board devices,whether or not the versions of the software of all the on-board devicesthat constitute the vehicle control system are consistent, by comparingthe version of the software of the specific on-board device and theversions of the software acquired from the other on-board devices withthe first consistency information.

In the vehicle control system according to the above aspect, a specificon-board device determines whether or not the versions of the softwareof all the on-board devices that constitute the vehicle control systemare consistent, when the power source of the vehicle is turned on. Thismakes it possible to further reduce the possibility of unexpectedvehicle control performed due to inconsistent versions of the on-boardsoftware.

In the above aspect, the specific on-board device may further include: afirst transmission unit; and a reception unit. The first transmissionunit may be configured to transmit, when the first determination unitdetermines that the versions of the software of all the on-board devicesthat constitute the vehicle control system are inconsistent, versioninformation including the versions of the software of all the on-boarddevices that constitute the vehicle control system to an externalserver. The reception unit may be configured to receive from theexternal server determination result information that is information ona determination result determined by the external server based on theversion information transmitted by the first transmission unit. Thedetermination result information indicates whether or not the versionsof the software of all the on-board devices that constitute the vehiclecontrol system are consistent.

According to the above configuration, even when a specific on-boarddevice fails to confirm the consistency of the versions of the software,the consistency of the versions of the software can be confirmed basedon the determination result in the external server. Therefore, theconsistency of the versions of the software can be determined with highaccuracy.

In the above aspect, the on-board devices may each be configured toretain the software of a current version and the software of a previousversion. The first consistency information storage unit may beconfigured to store the first consistency information in the currentversion and the first consistency information in the previous version.The specific on-board device may further include a switching instructionunit configured to instruct, when the first transmission unit fails tocommunicate with the external server, the other on-board devices toswitch execution target software to the software of the previousversions. The version acquisition unit may be configured to acquire,after the switching instruction unit instructs to switch the software,the versions of the software after switching from the other on-boarddevices. The first determination unit may be configured to determinewhether or not the versions of the software of all the on-board devicesthat constitute the vehicle control system are consistent, by comparingthe version of the software of the specific on-board device afterswitching and the versions of the software after switching acquired fromthe other on-board devices with the first consistency information in theprevious version.

According to the configuration, when the vehicle is in the environmentwhere communication with the external server is not possible, thesoftware of the on-board devices is switched to the software of previousversions. Hence, the consistency of the software of all the on-boarddevices that constitute the vehicle control system can be secured at anearly stage.

In the above aspect, the specific on-board device may further include: asoftware acquisition unit; and a software update unit. The softwareacquisition unit may be configured to acquire, when any one of the otheron-board devices fails, the software of a version at a time of failureof a failed on-board device from an external server and retain thesoftware. The software update unit may be configured to update, when theon-board device is replaced or repaired, and then the firstdetermination unit determines that the version of the software of thereplaced or repaired on-board device is inconsistent with the firstconsistency information, the software of the replaced or repairedon-board device with the software retained in the software acquisitionunit. The version acquisition unit may be configured to acquire from theother on-board devices the versions of the software after softwareupdate by the software update unit. The first determination unit may beconfigured to determine whether or not the versions of the software ofall the on-board devices that constitute the vehicle control system areconsistent, by comparing the version of the software of the specificon-board device and the versions of the software acquired from the otheron-board devices with the first consistency information.

According to the configuration, even when the versions of the softwareof all the on-board devices that constitute the vehicle control systembecome inconsistent due to replacement or repair of the on-boarddevices, and a sufficient wireless communication environment is notavailable to the vehicle, it is possible to swiftly restore the statewhere the versions of the software of all the on-board devices areconsistent.

In the above aspect, the external server may include: a secondconsistency information storage unit; a second determination unit; and asecond transmission unit. The second consistency information storageunit may be configured to prestore second consistency informationincluding a permitted combination of the versions of software of all theon-board devices that constitute the vehicle control system. The seconddetermination unit may be configured to determine whether or not theversions of the software of all the on-board devices that constitute thevehicle control system are consistent, by comparing the versions of thesoftware of all the on-board devices that constitute the vehicle controlsystem with the second consistency information based on the versioninformation transmitted from the first transmission unit. The secondtransmission unit may be configured to transmit to the specific on-boarddevice a determination result by the second determination unit as thedetermination result information.

According to the configuration, the consistency of the versions of thesoftware of all the on-board devices that constitute the vehicle controlsystem can be confirmed based on the second consistency informationretained in the external server. This makes it possible to determine theconsistency of the versions of the software of the on-board devices withhigher accuracy.

In the above aspect, the specific on-board device may further include aconsistency information update unit. The consistency information updateunit may be configured to update, when the second determination unitdetermines that the versions of the software of all the on-board devicesthat constitute the vehicle control system are consistent, the firstconsistency information stored in the first consistency informationstorage unit.

According to the configuration, the first consistency informationretained in a representative on-board device can be updated based on thedetermination result in the external server. Hence, the vehicle controlsystem can swiftly perform the consistency determination process nexttime without communicating with the external server.

In the above aspect, the specific on-board device may further include anupdate instruction unit. The update instruction unit may be configuredto instruct, when the second determination unit determines that theversions of the software of all the on-board devices that constitute thevehicle control system are inconsistent, the on-board device retainingthe software of a version inconsistent with the second consistencyinformation that is used for determination by the second determinationunit to perform software update.

According to the configuration, the software of the version that isinconsistent with the second consistency information can be updatedbased on the determination result in the external server. Hence, it ispossible to swiftly restore the state where the versions of the softwareof all the on-board devices are consistent.

A method for confirming software consistency according to a secondaspect of the present disclosure is executed on a computer included inany one specific on-board device out of a plurality of on-board devicesthat constitute a vehicle control system. The method for confirmingsoftware consistency includes: prestoring; acquiring; and determining.The prestoring is for prestoring first consistency information includinga permitted combination of versions of software of all the on-boarddevices that constitute the vehicle control system. The acquiring is foracquiring versions of the software in other on-board devices when apower source of a vehicle is turned on. The determining is fordetermining, when the versions of the software are acquired from theother on-board devices, whether or not the versions of the software ofall the on-board devices that constitute the vehicle control system areconsistent, by comparing the version of the software of the specificon-board device and the versions of the software acquired from the otheron-board devices with the first consistency information.

In the method for confirming software consistency according to the aboveaspect, the specific on-board device determines whether or not theversions of the software of all the on-board devices that constitute thevehicle control system are consistent, when the power source of thevehicle is turned on. This makes it possible to further reduce thepossibility of unexpected vehicle control performed due to inconsistentversions of the software of the on-board devices.

The present disclosure allows further reduction in the possibility ofunexpected vehicle control performed due to inconsistent versions of thesoftware of a plurality of on-board devices.

BRIEF DESCRIPTION OF THE DRAWINGS

Features, advantages, and technical and industrial significance ofexemplary embodiments of the disclosure will be described below withreference to the accompanying drawings, in which like numerals denotelike elements, and wherein:

FIG. 1 is a block diagram showing the schematic configuration of avehicle control system according to a first embodiment;

FIG. 2 is a functional block diagram of the vehicle control system shownin FIG. 1 ;

FIG. 3 shows one example of a consistency table stored in a consistencyinformation storage unit shown in FIG. 2 ;

FIG. 4 is a flowchart showing one example of a process of confirmingconsistency executed by a representative on-board device in the vehiclecontrol system according to the first embodiment;

FIG. 5 is a functional block diagram of a vehicle control systemaccording to a second embodiment;

FIG. 6 is a flowchart showing one example of a consistency confirmationprocess executed by a representative on-board device in the vehiclecontrol system according to the second embodiment;

FIG. 7 is a schematic view for describing the background of a vehiclecontrol system according to a third embodiment;

FIG. 8 is a functional block diagram of the vehicle control systemaccording to the third embodiment;

FIG. 9 is a flowchart showing one example of a software acquisitionprocess executed by a representative on-board device in the vehiclecontrol system according to the third embodiment; and

FIG. 10 is a flowchart showing one example of a consistency confirmationprocess executed by the representative on-board device in the vehiclecontrol system according to the third embodiment.

DETAILED DESCRIPTION OF EMBODIMENTS

Outline

In a vehicle control system according to the present disclosure, one ofa plurality of on-board devices that constitute the vehicle controlsystem confirms the consistency of the versions of software, wheneverthe power source of a vehicle is turned on, to reduce the possibility ofunexpected vehicle control performed due to inconsistent versions of thesoftware.

First Embodiment

Configuration

FIG. 1 is a block diagram showing the schematic configuration of avehicle control system according to a first embodiment.

A vehicle control system 100 is a system constituted of on-board devicesA to D that can communicate with each other. The system implementsspecified vehicle control by combining the functions of the on-boarddevices A to D. In the example of FIG. 1 , the vehicle control system100 is constituted of four on-board devices A to D. However, the numberof the on-board devices that constitute the vehicle control system 100is not limited to four. Examples of the specified vehicle controlimplemented by the vehicle control system 100 may include automaticdriving. The on-board devices A to D correspond to ECUs that controlvehicle travel functions, such as acceleration, deceleration, andsteering, and to an ECU that offers travel assistance by combining theECUs that control the vehicle travel functions. The on-board devices Ato D can communicate with an external server 2 through a wirelesscommunications device 1. In the following description, a specificon-board device A that is one of the plurality of on-board devices A toD that constitute the vehicle control system is called “representativeon-board device A.”

FIG. 2 is a functional block diagram of the vehicle control system shownin FIG. 1 . FIG. 3 shows one example of a consistency table stored in aconsistency information storage unit shown in FIG. 2 .

Representative On-Board Device A

Although the representative on-board device A is one of the on-boarddevices that provide a control function of the vehicle control system100, the representative on-board device A functions as a master devicein a process of confirming consistency of software versions of theon-board devices A to D. When the power source of a vehicle is turnedon, the representative on-board device A confirms the consistency ofversions of the software of all the on-board devices A to D thatconstitute the vehicle control system 100. The representative on-boarddevice A includes a software storage unit 10, a consistency informationstorage unit 11, a version acquisition unit 12, a determination unit 13,a transmission unit 14, a reception unit 15, a consistency informationupdate unit 16, and an update instruction unit 17.

The software storage unit 10 stores software for operating therepresentative on-board device A. The representative on-board device Aimplements specified functions for controlling the operation of thevehicle by executing the software stored in the software storage unit10.

The consistency information storage unit 11 prestores a consistencytable that defines a combination of the versions of the software of allthe on-board devices A to D that constitute the vehicle control system100. The combination of the versions of the software of the on-boarddevices A to D defined in the consistency table is a combination of theversions that is confirmed to normally operate the vehicle controlsystem 100. The combination is also a combination of the versionspermitted to be executed. For example, the consistency table may includea system number that identifies the vehicle control system 100, andsoftware versions of the on-board devices A to D, as shown in FIG. 3 .As the system number, an identifier that identifies the vehicle controlsystem 100 may be used, or the version of the vehicle control system 100may be used. Although the consistency table defines a single version foreach of the on-board devices in the example of FIG. 3 , the consistencytable may define the range of the versions of the on-board devices thatcan be combined. The consistency table may also define a plurality ofcombinations of versions (or the range of the versions) that arepermitted to be concurrently executed. When one on-board device retainsa plurality of software, the consistency table defines a permittedversion of each of the software. The consistency table is used asconsistency information (first consistency information) for thelater-described determination unit 13 to determine whether or not theversions of the software of the on-board devices A to D are consistent.

Whenever the power source of the vehicle is turned on, the versionacquisition unit 12 acquires the version of each software in the otheron-board devices B to D through communication. When there is anyon-board device that retains a plurality of software in the on-boarddevices B to D, the version acquisition unit 12 acquires the versions ofall the software retained in the pertinent on-board device.

Whenever the version acquisition unit 12 acquires the versions of thesoftware from the other on-board devices B to D, the determination unit13 determines whether or not the versions of the software of all theon-board devices A to D that constitute the vehicle control system 100are consistent. The determination unit 13 makes the determination bycomparing the versions of the software stored in the software storageunit 10 of the representative on-board device A and the versions of thesoftware that the version acquisition unit 12 acquires from the otheron-board devices B to D with the consistency information stored in theconsistency information storage unit 11. When determining that theversions of the software of all the on-board devices A to D thatconstitute the vehicle control system 100 are consistent based on theconsistency table stored in the consistency information storage unit 11,the determination unit 13 permits execution of the specified vehiclecontrol that is implemented by a combination of the functions of theon-board devices A to D.

When the determination unit 13 determines that the versions of thesoftware of all the on-board devices A to D that constitute the vehiclecontrol system 100 are inconsistent, the transmission unit 14 transmitsversion information including the versions of the software of theon-board devices A to D to the external server 2. The versioninformation transmitted by the transmission unit 14 is used in theexternal server 2 to reconfirm whether or not the versions of thesoftware of the on-board devices A to D are consistent.

The reception unit 15 receives various pieces of information transmittedfrom the external server 2. One piece of the information that thereception unit 15 receives from the external server 2 is determinationresult information. The determination result information indicateswhether or not the versions of the software of the on-board devices A toD are consistent. The determination result information can be obtainedas a result of determination made by the external server 2 based on theversion information received from the transmission unit 14.

The transmission unit 14 and the reception unit 15 communicate with theexternal server 2 through the wireless communications device 1 shown inFIG. 1 .

The consistency information update unit 16 updates the consistencyinformation stored in the consistency information storage unit 11, whenthe determination result information received by the reception unit 15indicates that the versions of the software of the on-board devices A toD are consistent. The consistency information update unit 16 may updatethe consistency information by replacing the combination of the versionsof the software included in the consistency table (first consistencyinformation) stored in the consistency information storage unit 11 witha combination of current versions of the software of the on-boarddevices A to D, or by adding the combination of the current versions ofthe software of the on-board devices A to D to the consistency tablestored in the consistency information storage unit 11. The consistencyinformation update unit 16 may update the consistency information byacquiring an updated consistency table from the external server 2, andreplacing the consistency table stored in the consistency informationstorage unit 11 with the consistency table acquired from the externalserver 2.

When the determination result information received by the reception unit15 indicates that the versions of the software of the on-board devices Ato D are inconsistent, the update instruction unit 17 instructs theon-board device retaining the software inconsistent with the combinationof the permitted versions to perform software update.

On-Board Devices B to D

The on-board devices B to D each include a software storage unit 20, atransmission unit 21, and a reception unit 22.

The software storage unit 20 stores software for operating each of theon-board devices B to D. The on-board devices B to D each implementspecified functions for controlling the operation of the vehicle byexecuting the software stored in the software storage unit 10.

The transmission unit 21 transmits the version of the software stored inthe software storage unit 20 to the representative on-board device A.The transmission unit 21 may transmit the version of the software to therepresentative on-board device A when the power source of the vehicle isturned on. Alternatively, the transmission unit 21 may transmit theversion of the software to the representative on-board device A inresponse to a request from the representative on-board device A that istransmitted when the power source of the vehicle is turned on.

The reception unit 22 receives various pieces of information transmittedfrom the representative on-board device A or the external server 2.

External Server 2

The external server 2 includes a consistency information storage unit30, a determination unit 31, a transmission unit 32, and a receptionunit 33.

The consistency information storage unit 30 prestores a consistencytable that defines a combination of the versions of the software of allthe on-board devices A to D that constitute the vehicle control system100. The combination of the software of the on-board devices A to Ddefined in the consistency table is a combination of the versions thatare confirmed to normally operate the vehicle control system 100. Thecombination is also a combination of the versions permitted to beexecuted. The consistency table stored in the consistency informationstorage unit 30 may include a system number that identifies the vehiclecontrol system 100, and software versions of the on-board devices A toD, as in the case illustrated in FIG. 3 . The consistency table is usedas consistency information (second consistency information) for thelater-described determination unit 31 to determine whether or not theversions of the software of the on-board devices A to D are consistent.

The determination unit 31 determines whether or not the versions of thesoftware of all the on-board devices A to D that constitute the vehiclecontrol system 100 are consistent. The determination unit 31 makes thedetermination by comparing the versions of the software of the on-boarddevices A to D included in the version information received from therepresentative on-board device A with the consistency table stored inthe consistency information storage unit 30. The external server 2 canmanage the software of all the versions of the on-board devices A to D.Therefore, as compared with the consistency table stored in theconsistency information storage unit 11 of the representative on-boarddevice A, the consistency table stored in the consistency informationstorage unit 30 can define a larger number of permitted combinations ofthe versions of the software of the on-board devices A to D. Therefore,even when the representative on-board device A fails to confirm theconsistency of the versions of the software, it is possible to determinethe consistency of the versions of the software of the on-board devicesA to D with high accuracy by making a determination again in theexternal server 2.

The transmission unit 32 transmits determination result information thatis the result of determination by the determination unit 31 to therepresentative on-board device A. The determination result informationindicates whether or not the versions of the software of the on-boarddevices A to D are consistent.

The reception unit 33 receives various pieces of information transmittedfrom the representative on-board device A.

Control Process

The control process executed by the representative on-board device Awill be described below with reference to FIGS. 2 and 4 .

FIG. 4 is a flowchart showing one example of a process of confirmingconsistency executed by the representative on-board device in thevehicle control system according to the first embodiment. The controlprocess shown in FIG. 4 is executed when the power source of the vehicleis turned on.

Step S1: the version acquisition unit 12 acquires the versions of thesoftware of the other on-board devices B to D. Then, the process shiftsto step S2.

Step S2: the determination unit 13 compares the version of the softwareof the representative on-board device A and the versions of the softwareacquired from the other on-board devices B to D with the consistencytable stored in the consistency information storage unit 11 to determinewhether the versions of the software of the on-board devices A to D areconsistent. When the determination result in step S2 is YES, the processshifts to step S3. Otherwise, the process shifts to step S4.

Step S3: the determination unit 13 permits execution of vehicle controlusing a combination of the on-board devices A to D. Then, thedetermination unit 13 ends the process.

Step S4: the transmission unit 14 transmits version informationincluding the version of the software of the representative on-boarddevice A, and the versions of the software acquired from the otheron-board devices B to D to the external server 2. Then, the processshifts to step S5.

Step S5: the reception unit 15 determines whether or not thedetermination result information was received from the external server2. When the determination result in step S5 is YES, the process shiftsto step S6. Otherwise, after waiting for a predetermined time, thereception unit 15 performs the determination process of step S5 again.When the state where the reception unit 15 is unable to receive thedetermination result information from the external server 2 continuesfor a predetermined time (timeout time) in step S5, the reception unit15 determines timeout, and ends the process of step S5. The process thenproceeds to step S6.

Step S6: the determination unit 13 determines whether or not theversions of the software of the on-board devices A to D are consistentbased on the determination result information received from the externalserver 2. When the determination result in step S6 is YES, the processshifts to step S7. Otherwise, the process shifts to step S9. When thereception unit 15 determines timeout in step S5, the determination unit13 determines the versions of the software of the on-board devices A toD are inconsistent.

Step S7: the determination unit 13 permits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, theprocess shifts to step S8.

Step S8: the consistency information update unit 16 updates theconsistency table stored in the consistency information storage unit 11.As described before, the consistency table may be updated by using theversions of the software used for determination in step S2, or may beupdated by using the consistency table acquired from the external server2 through the reception unit 15. Then, the process is ended.

Step S9: the determination unit 13 prohibits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, theprocess shifts to step S10.

Step S10: the update instruction unit 17 instructs an on-board deviceretaining the software of a version inconsistent with the consistencytable stored in the consistency information storage unit 11 to performsoftware update. Then, the update instruction unit 17 ends the process.

When the update instruction unit 17 instructs software update, and theon-board device to be updated completes reception of updated softwarefrom the server 2, a user may be encouraged to temporarily turn off andthen turn on the power source of the vehicle again so as to switch theexecution target software from the software of the current version tothe updated software.

When the software of any one of the on-board devices is updated based onthe update instruction in step S10, the consistency information updateunit 16 may update the consistency table stored in the consistencyinformation storage unit 11 as necessary.

Effects

In the vehicle control system 100 according to the present embodiment,the representative on-board device A acquires the versions of thesoftware of the on-board devices B to D when the power source of thevehicle is turned on, and determines whether or not the versions of thesoftware of the on-board devices A to D are consistent based on theconsistency table prepared in advance. Since the consistency of theversions of software is confirmed whenever the power source of thevehicle is turned on, it is possible to further reduce the possibilityof unexpected vehicle control executed due to the inconsistent versionsof the software of the on-board devices A to D.

In the vehicle control system 100 according to the present embodiment,when inconsistency is determined based on a consistency check ofsoftware versions (first check) by the representative on-board device A,the representative on-board device A transmits the versions of thesoftware of the on-board devices A to D to the external server 2. Theexternal server 2 then performs the consistency check of softwareversions again (secondary check) with use of the consistency tableretained in the external server 2. Even when the representative on-boarddevice A fails to confirm the consistency with the information that therepresentative on-board device A retains, the external server 2 performsthe consistency check again with the information that the externalserver 2 retains. This makes it possible to determine whether or not theversions of the software of the on-board devices A to D are consistentwith higher accuracy.

In the vehicle control system 100 according to the present embodiment,whether or not the versions of the software of the on-board devices A toD are consistent is determined by comparison with the consistency tableprepared in advance. As a result of comparison, it is possible toidentify which version of the software of which on-board device isconsistent with the consistency table. Since the information, used toidentify the on-board device that is inconsistent with the consistencytable, is applicable to software update, repair, or the like, of theon-board devices, it becomes possible to cope with the situation wherethe versions of the software are inconsistent at early stages.

In the vehicle control system 100 according to the present embodiment,when the representative on-board device A determines that the versionsof the software of the on-board devices A to D are inconsistent, andthen the external server 2 determines that the versions of the softwareof the on-board devices A to D are consistent, it is possible to updatethe consistency table stored in the consistency information storage unit11 of the representative on-board device A. If the consistency tablestored in the consistency information storage unit 11 is updated, therepresentative on-board device A can confirm the consistency of thesoftware versions by itself when the power source of the vehicle isturned on next time, unless the software of the on-board devices A to Dis changed. Hence, the time taken for confirmation of the consistencycan be shortened.

The representative on-board device A may be constituted of only thesoftware storage unit 10, the consistency information storage unit 11,the version acquisition unit 12, and the determination unit 13 in thefunctional block of the representative on-board device A shown in FIG. 2. Accordingly, it is possible to constitute a simple vehicle controlsystem that can determine only the consistency of the versions of thesoftware of the on-board devices A to D when the power source of thevehicle is turned on. The transmission unit 14 and the reception unit 15may further be added to this configuration to constitute a vehiclecontrol system that allows the primary check in the representativeon-board device A and the secondary check in the external server 2. Itis also possible to constitute a vehicle control system with theconsistency information update unit 16 or the update instruction unit 17being excluded from the functional block of the representative on-boarddevice A shown in FIG. 2 .

Second Embodiment

Configuration

FIG. 5 is a functional block diagram of a vehicle control systemaccording to a second embodiment.

The vehicle control system 200 according to the second embodiment ischaracterized in that the consistency of the versions of the software ofthe on-board devices A to D can be secured even in the state wherecommunication between the representative on-board device A and theexternal server 2 is not possible after the representative on-boarddevice A determines that the versions of the software of the on-boarddevices A to D are inconsistent. Hereinafter, description is mainlygiven of the difference between the present embodiment and the firstembodiment.

Representative On-board Device A

The software storage unit 10 of the representative on-board device Astores software Sa_cur of a current version and software Sa_old of aprevious version as the software for operating the representativeon-board device A. The software Sa_cur of the current version and thesoftware Sa_old of the previous version are stored in different storageregions in the software storage unit 10. At the time of software update,the software Sa_old of the previous version is deleted, the software ofthe current version is retained as the software of the previous version,and the updated software is newly stored as the software of the currentversion.

The consistency information storage unit 11 stores a consistency tableT_cur of a current version and a consistency table T_old of a previousversion as consistency information. At the time of update of theconsistency information, the consistency table T_old of the previousversion is deleted, the consistency table of the current version isretained as the consistency table of the previous version, and anupdated consistency table is newly stored as the consistency table ofthe current version.

The representative on-board device A further includes a switchinginstruction unit 18 and a software switch unit 19.

When the determination unit 13 determines that the versions of thesoftware of the on-board devices A to D are inconsistent, and therepresentative on-board device A is in the state where communicationwith the external server 2 is not possible, the switching instructionunit 18 instructs each of the on-board devices A to D to switchexecution target software from the software of the current version tothe software of the previous version. When the switching instructionunit 18 instructs the on-board devices A to D to switch the software, auser may be notified, by a display on the display unit or by voice, thatthe software is switched to the previous version.

When the switching instruction unit 18 instructs switching of thesoftware, the software switch unit 19 switch execution target softwarefrom the software Sa_cur of the current version to the software Sa_oldof the previous version. At the same time, the software switch unit 19switches the consistency information used by the determination unit 13from the consistency table T_cur of the current version to theconsistency table T_old of the previous version. When the power sourceof the vehicle is turned on next time, the software switch unit 19switches the software before the process of confirming the consistencyof the versions of the software of the on-board devices A to D.

In the case where the switching instruction unit 18 instructs switchingof the software, the version acquisition unit 12 and the determinationunit 13 confirm the consistency of the versions of the software of theon-board devices A to D when the power source of the vehicle is turnedon. The processes executed by the version acquisition unit 12 and thedetermination unit 13 are the same as normal processes performed whenthe power source is turned on. As a result of the processes, the versionacquisition unit 12 acquires from the other on-board devices B to D theversions of the software after switching. The determination unit 13confirms the consistency of the versions of software, by comparing theversion of the software of the representative on-board device A afterswitching and the versions of the software acquired from the otheron-board devices B to D after switching with the consistency table ofthe previous version.

On-Board Devices B to D

The software storage units 20 of the on-board devices B, C, D storesoftware Sb_cur, Sc_cur, Sd_cur of a current version, and softwareSb_old, Sc_old, Sd_old of a previous version as the software foroperating the on-board device B, C, D. Also in the on-board devices B toD, the software of the current version and the software of the previousversion are stored in different storage regions in the software storageunits 20, respectively. At the time of software update, the software ofthe previous version is deleted, updated software is newly stored as thesoftware of the current version, and the software of the current versionis retained as the software of the previous version. The software Sa_oldto Sd_old of the previous version is a combination of the software usedbefore the software Sa_cur to Sa_cur of the current version, and is alsoa combination of the software having version consistency.

Each of the on-board devices B to D further includes a software switchunit 23. When the switching instruction unit 18 instructs switching ofthe software, the software switch unit 23 switches execution targetsoftware from the software Sb_cur, Sc_cur, Sd_cur of the current versionto the software Sb_old, Sc_old, Sd_old of the previous version software,respectively. When the power source of the vehicle is turned on nexttime, the software switch unit 23 also switches the software before theprocess of confirming the consistency of the versions of the software ofthe on-board devices A to D.

Control Process

The control process executed by the representative on-board device Awill be described below with reference to FIGS. 5 and 6 .

FIG. 6 is a flowchart showing one example of a process of confirmingconsistency executed by a representative on-board device in the vehiclecontrol system according to the second embodiment. The control processshown in FIG. 6 is executed when the power source of the vehicle isturned on.

Step S21: the software switch unit 19 determines whether or notswitching of the software is instructed before the power source of thevehicle is turned on. In the case where an instruction is made forswitching the software of the current version of the on-board devices Ato D to the software of the previous version in later-described stepS28, step S21 is a determination step necessary for performing theswitching of the software when the power source is turned on for thefirst time after the instruction is made. Whether switching of thesoftware is instructed before the power source of the vehicle is turnedon may be determined based on a flag set in a nonvolatile storage regionor the like. When the determination result in step S21 is YES, theprocess shifts to step S22. Otherwise, the process shifts to step S23.

Step S22: when it is determined that switching of the software isinstructed in step S21, the software switch unit 19 switches executiontarget software from the software Sa_cur of the current version to thesoftware Sa_old of the previous version. The software switch unit 19also switches the consistency information used by the determination unit13 from the consistency table T_cur of the current to the consistencytable T_old of the previous version.

Although illustration is omitted, in other on-board devices that areinstructed to switch software, the software switch unit 23 switchesexecution target software from the software of the current version tothe software of the previous version, in parallel with the timing whenthe software is switched in the representative on-board device A.

Step S23: the version acquisition unit 12 acquires the versions of thesoftware of the other on-board devices B to D. Then, the process shiftsto step S24.

Step S24: the determination unit 13 determines whether or not theversions of the software of the on-board devices A to D are consistent,by comparing the version of the software of the representative on-boarddevice A and the versions of the software acquired from the otheron-board devices B to D with the consistency table stored in theconsistency information storage unit 11. When the determination resultin step S24 is YES, the process shifts to step S25. Otherwise, theprocess shifts to step S26.

Step S25: the determination unit 13 permits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, thedetermination unit ends the process.

Step S26: the transmission unit 14 determines whether or notcommunication with the external server 2 is possible. The transmissionunit 14 can determine whether or not communication is established withthe external server 2 based on, for example, the signal strength of aradio signal that the reception unit 15 receives. When the determinationresult in step S26 is YES, the process shifts to step S29. Otherwise,the process shifts to step S27.

Step S27: the determination unit 13 prohibits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, theprocess shifts to step S28.

Step S28: the switching instruction unit 18 instructs the on-boarddevice, which needs to switch software from the software of the currentversion to the software of the previous version, to switch the softwareof the current version to the software of the previous version. Then,the switching instruction unit 18 ends the process.

When the switching instruction unit 18 instructs the on-board devices Ato D to switch the software, the representative on-board device A maynotify a user that the software is switched. The representative on-boarddevice A may also encourage the user to temporarily turn off and thenturn on the power source of the vehicle at the time when preparation ofthe process of switching software is completed.

Step S29: the transmission unit 14 transmits version informationincluding the version of the software of the representative on-boarddevice A and the versions of the software acquired from the otheron-board devices B to D to the external server 2. Then, the processshifts to step S30.

Step S30: the reception unit 15 determines whether or not thedetermination result information was received from the external server2. When the determination result in step S30 is YES, the process shiftsto step S31. Otherwise, after waiting for a predetermined time, thereception unit 15 performs the determination step of step S30 again.When the state where the reception unit 15 is unable to receive thedetermination result information from the external server 2 continuesfor a predetermined time (timeout time) in step S30, the reception unit15 determines timeout, and ends the process of step S30. The processthen proceeds to step S31.

Step S31: the determination unit 13 determines whether or not theversions of the software of the on-board devices A to D are consistentbased on the determination result information received from the externalserver 2. When the determination result in step S31 is YES, the processshifts to step S32. Otherwise, the process shifts to step S34. When thereception unit 15 determines timeout in step S30, the determination unit13 determines that the versions of the software of the on-board devicesA to D are inconsistent.

Step S32: the determination unit 13 permits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, theprocess shifts to step S33.

Step S33: the consistency information update unit 16 updates theconsistency information stored in the consistency information storageunit 11. Then, he consistency information update unit 16 ends theprocess.

Step S34: the determination unit 13 prohibits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, theprocess shifts to step S35.

Step S35: the update instruction unit 17 instructs the on-board deviceretaining the software of a version inconsistent with the consistencytable stored in the consistency information storage unit 11 to performsoftware update. Then, the update instruction unit 17 ends the process.

When the update instruction unit 17 instructs software update, and theon-board device to be updated completes reception of updated softwarefrom the server 2, a user may be encouraged to temporarily turn off andthen turn on the power source of the vehicle again so as to switch theexecution target software from the software of the current version tothe updated software.

Effects

In the vehicle control system 200 according to the present embodiment,whether or not the versions of the software of the on-board devices A toD are consistent is determined when the power source of the vehicle isturned on as in the first embodiment. This makes it possible to furtherreduce the possibility of unexpected vehicle control executed due to theinconsistent versions of the software of the on-board devices A to D.

In addition, in the vehicle control system 200 according to the presentembodiment, each on-board device retains the software of the previousversion, and the representative on-board device A retains theconsistency table of the previous version. Therefore, when therepresentative on-board device A determines that the versions of thesoftware of the on-board devices A to D are inconsistent, but therepresentative on-board device A and the external server 2 are not in acommunicable state, it is possible to switch to the software of theprevious version. According to this configuration, when the latestversions of software are not consistent, and the representative on-boarddevice A fails to communicate with the external server, the consistencyof the versions of the software of the on-board devices A to D can besecured.

It is also possible to constitute a vehicle control system with theconsistency information update unit 16 or the update instruction unit 17being excluded from the functional block of the representative on-boarddevice A shown in FIG. 5 .

Third Embodiment

Configuration

FIG. 7 is a schematic view for describing the background of a vehiclecontrol system according to a third embodiment.

The on-board devices A to D that constitute a vehicle control system 300have software having versions Sa to Sd that are consistent at the timeof shipment of the vehicle (left column of FIG. 7 ). The consistency ofthe versions of the software of the on-board devices A to D may becompromised because of the versions being mismatched due to replacementof the on-board devices A to D, or replacement of components, such assubstrates, included in the on-board devices A to D. For example, assumethe case where the on-board device C fails (a central column of FIG. 7), and the failed on-board device C is replaced with a new on-boarddevice. As a result of the replacement, the version of software Sc′ ofthe new on-board device C may be different from the version of thesoftware Sc before the replacement (right column of FIG. 7 ). In thiscase, the version Sc′ of the software of the new on-board device C isnot necessarily consistent with the versions of the software of theon-board devices A, B, D. Depending on the version of the software Sc′,it may be difficult to confirm the software consistency of the on-boarddevices A to D through only the consistency confirmation processexecuted by the representative on-board device A. In the case where thevehicle is used at the places where a sufficient wireless communicationenvironment is not available, such as undergrounds and mountain areas,it is difficult to confirm the consistency through communication withthe external server. This may lead to the situation where the vehiclecontrol functions implemented by a combination of the on-board devices Ato D are assumed to be restricted, or software update may be assumed totake time. As a result, the convenience of the user may be deteriorated.

On the assumption of such problems, the vehicle control system accordingto the third embodiment is characterized in that the consistency of theversions of the software of the on-board devices A to D can swiftly besecured even when repair or replacement of the on-board devices A to Dis needed. Hereinafter, description is mainly given of the differencebetween the present embodiment and the first embodiment.

FIG. 8 is a functional block diagram of the vehicle control systemaccording to the third embodiment.

Representative On-Board Device A

In addition to the software storage unit 10, the consistency informationstorage unit 11, the version acquisition unit 12, the determination unit13, the transmission unit 14, and the reception unit 15 described in thefirst embodiment, the representative on-board device A includes asoftware acquisition unit 40 and a software update unit 41.

When any one of the other on-board devices B to D fails, and replacementor repair is needed, the software acquisition unit 40 receives from theexternal server 2 the software of the current version of the failedon-board device while communication with the external server 2 ispossible, and stores the acquired software. The software acquisitionunit 40 is able to detect occurrence of failure in any one of theon-board devices B to D based on a failure notification output from thefailed on-board device. FIGS. 7 and 8 shows an example in which theon-board device C fails. The software acquisition unit 40 acquiressoftware Sc of the on-board device C, which is consistent with theversions of the software Sa, Sb, Sd of the on-board device A, B, D, fromthe external server 2, and stores the acquired software Sc. The versionof the software that the software acquisition unit 40 acquires from theexternal server 2 may be acquired from the failed on-board device Cthrough communication, or may be acquired from the consistency tablestored in the consistency information storage unit 11.

When the determination unit 13 determines that the versions of thesoftware of the on-board devices A to D are inconsistent afterreplacement or repair of the failed on-board device, and determines thatthe on-board device, which retains the software of the version that isdetermined to be inconsistent with the consistency table, is thereplaced or repaired on-board device, the software update unit 41 writesthe software to be stored in the software acquisition unit 40 in thesoftware storage unit 20 of the replaced or repaired on-board device.Then, the software update unit 41 instructs the replaced or repairedon-board device to switch the software.

In the case where the software update unit 41 instructs switching ofsoftware, the version acquisition unit 12 and the determination unit 13confirm the consistency of the versions of the software of the on-boarddevices A to D when the power source of the vehicle is turned on nexttime. The processes executed by the version acquisition unit 12 and thedetermination unit 13 are the same as normal processes performed whenthe power source is turned on.

On-Board Devices B to D

The on-board devices B to D may further include a software switch unit23 same as the software switch unit described in the second embodiment.When the software update unit 41 instructs switching of the software,the software switch unit 23 switches execution target software from thesoftware of the current version to the software written by the softwareupdate unit 41. The software switch unit 23 switches the software beforethe process of confirming the consistency of the versions of thesoftware of the on-board devices A to D, when the power source of thevehicle is turned on next time.

Control Process

The control process executed by the representative on-board device Awill be described below with reference to FIGS. 8 to 10 .

FIG. 9 is a flowchart showing one example of a software acquisitionprocess executed by the representative on-board device in the vehiclecontrol system according to the third embodiment.

Step S41: the reception unit 15 determines whether or not a failurenotification is received from the other on-board devices B to D. Whenthe determination result in step S41 is YES, the process shifts to stepS42. Otherwise, the reception unit 15 ends the step.

Step S42: the software acquisition unit 40 acquires the software of thecurrent version of the failed on-board device from the external server2, and stores the acquired software. Then, the software acquisition unit40 ends the process.

FIG. 10 is a flowchart showing one example of a process of confirmingconsistency executed by the representative on-board device in thevehicle control system according to the third embodiment. The controlprocess shown in FIG. 10 is executed when the power source of thevehicle is turned on.

Step S51: the version acquisition unit 12 acquires the versions of thesoftware of the other on-board devices B to D. Then, the process shiftsto step S52.

Step S52: the determination unit 13 determines whether or not theversions of the software of the on-board devices A to D are consistent,by comparing the version of the software of the representative on-boarddevice A and the versions of the software acquired from the otheron-board devices B to D with the consistency table stored in theconsistency information storage unit 11. When the determination resultin step S52 is YES, the process shifts to step S54. Otherwise, theprocess shifts to step S53.

Step S53: the determination unit 13 permits execution of the vehiclecontrol using a combination of the on-board devices A to D. Then, thedetermination unit 13 ends the process.

Step S54: the determination unit 13 determines whether or not theon-board device having software of the version, which is inconsistentwith the consistency table, is a replaced or repaired on-board device.Whether or not the on-board device is replaced or repaired can beidentified based on the failure notification received in step S41 ofFIG. 9 . When the determination result in step S54 is YES, the processshifts to step S55. Otherwise, the process shifts to step S56.

Step S55: the software update unit 41 writes the software to be storedin the software acquisition unit 40 in a specified region of thesoftware storage unit 20 of the replaced or repaired on-board device.The software update unit 41 then instructs the replaced or repairedon-board device to perform updating of software. Then, the process isended.

Step S56: the determination unit 13 prohibits execution of the vehiclecontrol with use of a combination of the on-board devices A to D. Then,the determination unit 13 ends the process.

When the software update unit 41 instructs switching of the software, auser may be encouraged to temporarily turn off and then turn on thepower source of the vehicle again in order to switch execution targetsoftware of the replaced or repaired on-board device from the softwareof the current version to updated software. The representative on-boarddevice A may temporarily turn off and then turn on again the powersource of the on-board device which is instructed by the software updateunit 41 to switch the software. In the on-board device instructed by thesoftware update unit 41 to switch the software, the software switch unit23 switches execution target software to the software written in thesoftware storage unit 20 by the software update unit 41, when the powersource is turned on next time.

Effects

In the vehicle control system 300 according to the present embodiment,whether or not the versions of the software of the on-board devices A toD are consistent is determined when the power source of the vehicle isturned on as in the first embodiment. This makes it possible to furtherreduce the possibility of unexpected vehicle control executed due to theinconsistent versions of the software of the on-board devices A to D.

In addition, in the vehicle control system 300 according to the presentembodiment, when replacement or repair of the on-board devices B to D isneeded due to failure, the representative on-board device A acquiresfrom the external server 2 in advance the software of a failed on-boarddevice which is confirmed to be consistent in advance. When the versionof the software of the replaced or repaired on-board device isinconsistent with the consistency table after replacement or repair ofthe failed on-board device, the representative on-board device Aswitches the inconsistent software with the software acquired from theexternal server 2 in advance. Therefore, even when the versions of thesoftware of the on-board devices A to D are inconsistent due toreplacement or repair of an on-board device, and a sufficient wirelesscommunication environment is not available, it is possible to swiftlyrestore the state where the on-board devices A to D are consistent. As aresult, restrictions of the vehicle control functions implemented with acombination of the on-board devices A to D can be eliminated at an earlystage, and therefore the convenience of the user can be improved.

The method for confirming software consistency according to the thirdembodiment may be combined with the vehicle control system 100 accordingto the first embodiment, or the vehicle control system 200 according tothe second embodiment. Specifically, the vehicle control system 100according to the first embodiment, or the vehicle control system 200according to the second embodiment may further include the softwareacquisition unit 40 and the software update unit 41, and therepresentative on-board device A is configured to be able to execute theprocess of steps S41, S42 shown in FIG. 9 and the process of steps S54,S55 shown in FIG. 10 . The process of steps S54, S55 shown in FIG. 10 ispreferably executed after the primary check where the determination unit13 determines that the versions of software are inconsistent, and beforethe external server 2 executes the secondary check. With suchconfiguration, the consistency is preferentially determined with theinformation retained in the representative on-board device A, and whenit is difficult to make the determination by only the representativeon-board device A, the secondary check in the external server 2 isperformed. Thus, the process of determining software consistency canefficiently be performed without communication. When there is a step(S26 of FIG. 6 ) of determining whether or not communication between thevehicle and the external server 2 is possible, and the vehicle is unableto communicate with the external server 2, the process of step S54, S55of FIG. 10 may be executed.

Other Modifications

The control processes of FIGS. 4, 6, 9 and 10 may be implemented withdedicated circuitry, or may be implemented by causing a computer, suchas an ECU having a processor, a ROM, a RAM, a hard disk, and the like,to execute the process of the respective steps. When the computer suchas an ECU is caused to execute the control processes of FIGS. 4, 6, 9and 10 , programs described to enable execution of the control processesmay be prestored in a storage device, such as a ROM or a hard disk, suchthat the programs may be read from the storage device and executed bythe processor included in the computer.

In the embodiments described above, one of the on-board devices thatprovide the control functions of the vehicle control system confirms theconsistency of the versions of software as a representative on-boarddevice. However, the above-described control process may be executed byan on-board device dedicated to confirming the consistency of theversions of software.

The present disclosure can be used for the vehicle control system thatimplements specified vehicle control functions with a combination of aplurality of on-board devices.

What is claimed is:
 1. A vehicle control system comprising a pluralityof on-board devices, wherein any one of the on-board devices is aspecific on-board device and the specific on-board device includes: afirst memory configured to store first consistency information on apermitted combination of versions of software of the respective on-boarddevices; and a processor configured to operate as: a version acquisitionunit configured to acquire versions of the software included in therespective on-board devices when a power source of a vehicle is turnedon; a first determination unit configured to determine whether or not acombination of the versions of the software of the respective on-boarddevices has consistency, by comparing the versions of the softwareincluded in the respective on-board devices with the first consistencyinformation; a first transmission unit configured to transmit, inresponse to a determination by the first determination unit that thecombination of the versions of the software of at least two of theon-board devices does not have the consistency, version informationincluding the versions of the software of the at least two of theon-board devices to an external server, and not transmit the versioninformation to the external server when a determination is made by thefirst determination unit that the combination of the versions of thesoftware of the respective on-board devices has the consistency; and areception unit configured to receive, from the external server,determination result information that is information on a determinationresult determined by the external server based on the versioninformation transmitted by the first transmission unit after thedetermination by the first determination unit that the combination ofthe versions of the software of the at least two of the on-board devicesdoes not have the consistency, the determination result informationindicating whether or not the combination of the versions of thesoftware of the at least two of the on-board devices has theconsistency.
 2. The vehicle control system according to claim 1, whereinthe on-board devices are each configured to retain the software of acurrent version and the software of a previous version, the first memoryis configured to store the first consistency information in the currentversion and the first consistency information in the previous version,the processor of the specific on-board device is further configured tooperate as a switching instruction unit configured to instruct, when thefirst transmission unit fails to communicate with the external server,the other on-board devices to switch execution target software to thesoftware of the previous version, the version acquisition unit isconfigured to acquire, after the switching instruction unit instructs toswitch the software, the versions of the software after switching fromthe other on-board devices, and the first determination unit isconfigured to determine whether or not the combination of the versionsof the software of the respective on-board devices that constitute thevehicle control system has the consistency, by comparing a version ofthe software of the specific on-board device after switching and theversions of the software acquired from the other on-board devices afterswitching with the first consistency information in the previousversion.
 3. The vehicle control system according to claim 1, wherein theprocessor of the specific on-board device is further configured tooperate as: a software acquisition unit configured to acquire, when anyone of the other on-board devices fails, the software of a version at atime of failure of a failed on-board device from the external server,and retain the software; and a software update unit configured toupdate, when the on-board device is replaced or repaired and then thefirst determination unit determines that the version of the software ofthe replaced or repaired on-board device is inconsistent with the firstconsistency information, the software of the replaced or repairedon-board device with the software retained in the software acquisitionunit, the version acquisition unit is configured to acquire from theother on-board devices the versions of the software after softwareupdate by the software update unit, and the first determination unit isconfigured to determine whether or not the combination of the versionsof the software of the respective on-board devices that constitute thevehicle control system has the consistency, by comparing the version ofthe software of the specific on-board device and the versions of thesoftware acquired from the other on-board devices with the firstconsistency information.
 4. The vehicle control system according toclaim 1, wherein the external server includes a processor configured tooperate as: a second consistency information storage unit configured tostore second consistency information on the permitted combination of theversions of software of the on-board devices that constitute the vehiclecontrol system; a second determination unit configured to determinewhether or not the combination of the versions of the software of therespective on-board devices that constitute the vehicle control systemhas the consistency, by comparing the versions of the software of therespective on-board devices that constitute the vehicle control systemwith the second consistency information based on the version informationtransmitted from the first transmission unit; and a second transmissionunit configured to transmit to the specific on-board device thedetermination result by the second determination unit as thedetermination result information.
 5. The vehicle control systemaccording to claim 4, wherein the processor of the specific on-boarddevice is further configured to operate as a consistency informationupdate unit configured to update, when the second determination unitdetermines that the combination of the versions of the software of therespective on-board devices that constitute the vehicle control systemhas the consistency, the first consistency information stored in thefirst memory.
 6. The vehicle control system according to claim 4,wherein the processor of the specific on-board device is furtherconfigured to operate as an update instruction unit configured toinstruct, when the second determination unit determines that thecombination of the versions of the software of the respective on-boarddevices that constitute the vehicle control system does not have theconsistency, the on-board device retaining the software of a versioninconsistent with the second consistency information that is used fordetermination by the second determination unit to perform softwareupdate.
 7. A method for confirming software consistency executed in acomputer included in any one specific on-board device out of a pluralityof on-board devices in a vehicle control system including the on-boarddevices, the method comprising: storing first consistency information ona permitted combination of versions of software of the respectiveon-board devices; acquiring versions of the software included in therespective on-board devices when a power source of a vehicle is turnedon; determining whether or not a combination of the versions of thesoftware of the respective on-board devices has consistency, bycomparing the versions of the software included in the respectiveon-board devices with the first consistency information; transmitting,in response to the determining making a determination that thecombination of the versions of the software of at least two of theon-board devices does not have the consistency, version informationincluding the versions of the software of the at least two of theon-board devices to an external server; not transmitting the versioninformation to the external server when a determination is made that thecombination of the versions of the software of the respective on-boarddevices has the consistency; and receiving, from the external server,determination result information that is information on a determinationresult determined by the external server based on the transmittedversion information after the determination that the combination of theversions of the software of the at least two of the on-board devicesdoes not have the consistency, the determination result informationindicating whether or not the combination of the versions of thesoftware of the at least two of the on-board devices has theconsistency.
 8. An over-the-air master connected to a plurality oftarget electronic control units, the over-the-air master comprising: afirst memory configured to store first consistency information on apermitted combination of versions of software of the respective targetelectronic control units that constitute a vehicle control system; and aprocessor configured to acquire versions of the software stored in therespective target electronic control units when an ignition is turnedon, determine whether or not a combination of the versions of thesoftware of the respective target electronic control units hasconsistency, by comparing the versions of the software stored in therespective target electronic control units with the first consistencyinformation, transmit, in response to a determination that that thecombination of the versions of the software of the respective targetelectronic control units does not have the consistency, versioninformation including the versions of the software of the respectivetarget electronic control units to a center, not transmit the versioninformation to the center when a determination is made that the versionsof the software of the target electronic control units has theconsistency, and receive, from the center, determination resultinformation that is information on a determination result determined bythe center based on the version information transmitted after thedetermination that the combination of the versions of the software ofthe respective target electronic control units does not have theconsistency, the determination result information indicating whether ornot the combination of the versions of the software of the respectivetarget electronic control units has the consistency.
 9. A masterconnected to a plurality of electronic control units, the mastercomprising: a first memory configured to store first consistencyinformation on a permitted combination of versions of software of therespective electronic control units that constitute a vehicle controlsystem; and a processor configured to acquire versions of the softwarestored in the respective electronic control units when an ignition isturned on, determine whether or not a combination of the versions of thesoftware of the respective electronic control units has consistency, bycomparing the versions of the software stored in the respectiveelectronic control units with the first consistency information,transmit, in response to a determination that the combination of theversions of the software of the respective electronic control units doesnot have the consistency, version information including the versions ofthe software of the respective electronic control units to a server, nottransmit the version information to the server when a determination ismade that the versions of the software of the electronic control unitshas the consistency, and receive, from the server, determination resultinformation that is information on a determination result determined bythe server based on the version information transmitted after thedetermination that the combination of the versions of the software ofthe respective electronic control units does not have the consistency,the determination result information indicating whether or not thecombination of the versions of the software of the respective electroniccontrol units has the consistency.